Forms, cookies and consent: a practical privacy checklist for your website

Privacy law is written for organisations, not for websites, which is why most advice is either legal text nobody applies or a plugin that promises compliance it cannot deliver. This is the practical half: the parts of a website a development team controls, and what "done properly" looks like for each.

This is not legal advice. Your obligations depend on where you and your customers are and what you do with data; a lawyer or your DPO decides that. What follows is how to implement the decision once it is made.

Know what your site collects before you write a policy

Start with an inventory, because almost every site collects more than its owner thinks: contact form fields, newsletter sign-ups, account details, order and payment records, support chat transcripts, analytics identifiers, advertising pixels, session recordings, server logs and error reports. Write down for each one what is collected, why, where it is stored, who can see it and how long it is kept. That single document answers most of a compliance questionnaire and tells you what to delete.

Cookie consent that is real

• Nothing non-essential fires before consent. A banner that loads analytics and advertising scripts anyway is worse than no banner — it is documented non-compliance.
• Refusing is as easy as accepting. Same prominence, same number of clicks.
• The choice is remembered and revocable, with a link to change it later.
• Categories, not one switch: necessary, analytics, marketing, at minimum.

Note that EU and UK expectations are stricter than most US state laws, which often centre on opting out of the sale or sharing of personal information. Building to the stricter standard once is cheaper than maintaining two behaviours.

Analytics without over-collecting

Turn on IP anonymisation, shorten data retention to what you actually analyse, and avoid sending personal identifiers into analytics via URLs or form fields. If you need numbers rather than individuals, privacy-friendly analytics avoids the cookie question altogether — and loads faster, which is its own benefit. On this site we defer the analytics library until after page load for exactly that reason; see the performance notes.

Forms: collect less, say why, protect them

1. Ask for the minimum. Every optional field is data you must protect, justify and eventually delete.
2. Say what happens next, in one plain line beside the button, not only in the policy.
3. Consent for marketing is separate from submitting the form, unticked by default, and recorded.
4. Protect the form without profiling the visitor. Many anti-spam services work by tracking users across sites; a server-side check does not. Ours is a signed arithmetic question plus rate limiting, so nothing about the visitor leaves the site.
5. Encrypt in transit and at rest, and keep submissions out of shared inboxes nobody audits.

Third-party scripts are your responsibility

Chat widgets, heatmaps, embedded video, ad pixels and font services all load code you did not write and may send data abroad. Keep a list, justify each one, load them only after consent where required, and remove the ones no one has opened a report from in six months. Fonts and video embeds have privacy-preserving modes — use them.

Retention, access and deletion

Decide how long enquiries, orders and analytics are kept, then make deletion automatic rather than aspirational. Have a route for a person asking what you hold, and make sure the people who answer that email know where to look. If a processor holds data for you — hosting, email, CRM — make sure the contracts exist.

What to publish

A privacy policy that matches your inventory rather than a template's imagination, a cookie notice listing the actual cookies, terms of use, and a contact route for privacy questions. Then review it whenever you add a tool. If your site has grown past what its policy describes, that is usually the moment to rebuild the foundations — see why your business still needs a website and how we build them.

Want this audited on your site? Ask us for a look, or read how we work with clients abroad in working with an overseas web agency.